Hello,
Just wanted to drop some UDP flooding with an interface ACL.
I configured:
interface Vlan1373
ip access-group block-flood in
exit
Access-list is very simple:
edge1-ams3#sh ip access-lists block-flood
Extended IP access list block-flood
10 deny udp any host 1.2.3.4 (589878 matches)
20 permit ip any any (149516 matches)
edge1-ams3#
edge1-ams3#sh int Vl1373 | inc input rate
30 second input rate 2772775000 bits/sec, 435403 packets/sec
edge1-ams3#
The interface has a quite high amount of pps, but the acl hit count
increases only by less than 200/sec for both entries together.
Does that ACL not filter all traffic passing the interface or why does the
delta of ACL hits not match the number of incoming pps ?
Maybe it counts only packets going to the RP or something is cached and
counts only every x packets ?
Hardware is a Sup2T + WS-X6704-10GE, all traffic in that vlan is routed.
kind regards
Rolf
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
